Recent developments in multimedia forensics have made tremendous progress that allow forensics analysis of image and video data. Especially, source attribution methods made it possible to map images and videos to the specific camera or camcorder that they have been captured with. Although due to such methods, multimedia data now can be used as evidence in court of law, some ethical questions has also been raised addressing the individual rights to privacy and anonymity. It is especially important for the activists and human right defenders to stay anonymous while spreading their images and videos, such as during and after the Arab Spring events.
The problem of anonymizing images and videos against source attribution ultimately relies on the ability to circumvent underlying attribution techniques. Robustness of source attribution techniques under various image and video processing based operations and attacks has long been the focus of research and a number of techniques are already proposed to counter digital media forensics techniques.
To date, the most successful source attribution method was proposed by Lukas et al. This method fingerprints an imaging device by extracting the so called photo-response non-uniformity (PRNU) noise pattern. This noise pattern is an imperfection caused mainly by the impurities in silicon wafers and affects the light sensitivity of each individual pixel. The method utilizes an image denoising approach to estimate a sensor's PRNU noise pattern in a way that the resulting residue contains the needed noise components. However, since the underlying noise pattern model used in denoising is an idealistic one the residue signal also contains contributions from the image content. To eliminate this content-dependent component of the noise, denoising is applied to a set of images (captured by the same camera) and the corresponding noise residues are combined together with a maximum likelihood estimator to obtain the fingerprint of the camera. To determine whether a given image is captured by a digital camera, a fingerprint is estimated from an individual image and this fingerprint is compared with the camera's fingerprint using normalized correlation (NC) or peak to correlation energy (PCE), which determines the sharpness of correlation peak. A decision is made by comparing the measured statistic to a pre-determined decision threshold. Goljan et al. also showed that PRNU noise pattern can be reliably extracted under JPEG compression with a quality factor as low as 50% even if an image is rescaled or cropped.
There are two possible approaches to attacking PRNU noise pattern based source attribution technique. The first approach relies on weakening the PRNU noise pattern, which can be achieved by subjecting the images to strong filtering or severe compression, so that PRNU noise pattern cannot be reliably detected. Alternatively, since each PRNU noise estimate value is related to a pixel's light sensitivity, it is very important to align the two noise values extracted from the same pixel when computing the matching statistic. Therefore, the second approach focuses on disturbing the alignment between the two noise patterns, rather than trying to remove the pattern itself. Although the two approaches are not exclusive of one another, they can be compared on the basis of what level of reduction in the image quality they cause to achieve a desired level of anonymization. In this regard, the techniques included in the former approach are more intrusive and are not content-aware in most cases. As a result, anonymity is achieved at the expense of severe reduction in the image quality. The latter approach, however, potentially offers a better trade-off between image quality and level of anonymization as synchronization at the detector can be attacked by introducing perceptually less disturbing artifacts.
The most straight forward way to accomplish de-synchronization (i.e., misalignment) is to apply geometrical transformations such as resizing, rotation and barrel distortion. Goljan et al. showed that the parameters of geometrical distortions can be determined by a brute-force search using fingerprint digests, and fingerprints can still be aligned if they are of the same camera. This work showed that effective anonymization against image source attribution needs to utilize irreversible (non-revertible) transformations.
Another way to prevent fingerprint alignment is to delete parts of an image so that rather than shifting the whole pixel coordinate system only parts of it are shifted by arbitrary amounts. This can be realized by randomly removing rows and columns from the image. Although this may work satisfactorily on nature images, it will cause noticeable visual distortions especially if the image has well-defined geometrical structures. As an example, see the coins image in FIG. 1-a where the columns marked in red are removed to obtain the image in FIG. 1-b. As can be noticed, after deletion, the edges of the coins have become non-smooth, which shows that random removal of column pixels will not produce visually desirable images. Moreover, based on the visual distortions, one might very reliably guess which columns are removed, and take this information into account when performing matching. As a consequence, reliable anonymization of images require more sophisticated methods that not only can distort the alignment in a very complicated manner but also at the same time ensure the visual quality of the modified image.